I have finally figured out how to use VLANs in my flat. With my wired network this is all working according to my expectations. Sadly the WiFi clients don’t get and IP address offered with the current configuration.
I am aware that some of my networks don’t have DHCP servers so far and that will be fixed as soon as my WiFi is working. The firewall is also a WIP to enforce ACLs between the different VLANs.
I just made the following observation: If I allow untagged traffic and remove the bridge from the datapath configuration then I get an IP address and internet access works.
Edit: If my understanding is correct this means that my wifi traffic is untagged? But then how does the client receive the IP address?
Update: So all appears to work as desired.if I do a torch on the wifi interface then the traffic indeed is tagged as VLAN id 12. So allowing only tagged traffic is the right option.
###############################################################################
# Topic: Using RouterOS to VLAN your network
# Example: Router-Switch-AP all in one device
# Web: http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1
# RouterOS: 6.47.10
# Date: February 17, 2023
# Notes: Start with a reset (/system reset-configuration)
# Thanks: mkx, sindy
###############################################################################
....
#######################################
# VLAN Security
#######################################
# Only allow ingress packets without tags on Access Ports
/interface bridge port
set bridge=BR1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged [find interface=ether2]
set bridge=BR1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged [find interface=ether3]
set bridge=BR1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged [find interface=ether4]
set bridge=BR1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged [find interface=ether5]
set bridge=BR1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged [find interface=wlan1]
set bridge=BR1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged [find interface=wlan2]
Edit: I’ll mark this as answered as soon as I understand why the “frame-types” setting is inverted to my expectation.
No doubt your config is not correct
Post both configs MT and CCS326
Assuming you get a public IP from the draytek modem and the AX3 is acting as a full AP router.
/export file=anynamewyouwish ( minus router serial number, any public WANIP information, keys etc._)
unless you use capsman and then I cannot help.
Okay so update after a good night of sleep and a little bit of research:
I got my queues finally to work (unrelated). I learnt that I need to disable the fast-track forward chain rule.
The network behaves at the moment like it did without VLANs.
I can see the correct VLAN IDs with their corresponding IPs when I torch my bridge.
The CSS326 switch isn’t involved in any WiFi topics. As it is a CSS switch it runs SwOS and as such a backup doesn’t reveal much. Also, you can’t export a SwOS config without the sensitive information and it is a single line. As such I’ll omit it for now. I’ll dig up my scripts to clean it if we really need it.
I still don’t understand why the “frame-types” setting is inverted to what I expect it to be. backup-non-sensitive.rsc (23.8 KB)
I believe I have solved the mystery of why the “frame-types” are inverted to what I’d expect them to be: The wireless configuration has a “vlan-id” set which means that the wireless chip is tagging the packets already. When they arrive on the bridge this means tagged packets arrive and the setting “admint-only-vlan-tagged” is needed.
Edit: Would be nice if someone could confirm my logic or correct me if I am wrong.
This is in my eyes supported by the block diagram for the hAP ax3:
Although the settings are for an older version and the scenario is a little bit different, the principle is the same: when wireless packets arrive at the chip, they get tagged and get forwarded to the bridge
